Email-Worm.Win32.Warezov.sk

Technical Details

This malicious program is a worm. It is a Windows PE EXE file. It is 124928 bytes in size. It is packed using UPX. The unpacked file is approximately 153KB in size.

Installation

When launched, the worm creates the following files:

%System%\rasppowr.dll 
%System%\rasppowr.exe
%System%\rasppowr.z1    
%System%\rasppowr.dat

The worm also creates the following system registry key:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rasppowr]
"DllName" = "%System%\rasppowr.dll"
"Startup" = "WlxStartupEvent"
"Shutdown" = "WlxShutdownEvent"
"Impersonate" = dword:00000000
"Asynchronous" = dword:00000000

Propagation

This malicious program spreads via ICQ. It sends messages containing the following text: "Check this:" or "My party pics:". A link to the executable file of the latest variant of Warezov follows the text.

If the user opens the link in the web browser, s/he will be asked if s/he wants to download a file called “photo.pif”. When this file is launched, the worm will be installed to the victim machine.

Payload

The worm disables the antivirus and firewall solutions listed below:

Sygate Personal Firewall
Symantec Internet Security
Agnitum Outpost Firewall
McAfee.com Personal Firewall
Kerio WinRoute

The worm is also able to download other malicious programs from the remote malicious user’s sites, and launch them for execution on the victim machine.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the worm process (it may be called "rasppowr.exe").
2. Delete the original worm file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the following files:

   %System%\rasppowr.dll 
   %System%\rasppowr.exe
   %System%\rasppowr.z1    
   %System%\rasppowr.dat

4. Delete the following system registry keys: (see What is a system registry and how do I use it for details on how to edit the registry).
   [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rasppowr]
5. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).